How to protect domains that never send email

Short answer: for any domain that never sends email, publish an SPF record that authorises nobody, a DMARC record that rejects everything, and (if it also receives no email) a null MX record. It takes four DNS records and closes off a favourite target for phishing.

Why parked domains get spoofed

Organisations collect domains: old brand names, country variants, typo protection, campaign sites. Nobody watches them, and a domain with no SPF or DMARC record gives receivers nothing to reject forged mail with. Attackers know that a message from yourbrand.net looks just as convincing as one from yourbrand.com.

The records

1. SPF: no servers are allowed to send

example.net. IN TXT "v=spf1 -all"

2. DMARC: reject everything that claims to be from the domain

_dmarc.example.net. IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@example.com"

The reporting address is optional, but it is a cheap early warning: if reports start showing mail from a domain that should be silent, someone is using it. If the address is on another domain, that domain has to authorise it.

3. Null MX: the domain does not accept email

example.net. IN MX 0 .

A null MX (RFC 7505) tells senders not to try delivering to the domain, so mail to it bounces immediately. The RFC also lets receivers reject mail whose sender address uses a null-MX domain. Only add it if the domain really receives no email. Remove any other MX records at the same name.

4. DKIM: an empty key for every selector

*._domainkey.example.net. IN TXT "v=DKIM1; p="

An empty p= means the key is revoked, so any DKIM signature claiming to be from the domain fails. This follows the M3AAWG guidance for parked domains.

What about subdomains?

DMARC covers them through sp=reject (and receivers following the new standard also apply it to subdomains that do not exist). SPF does not inherit, so a forged anything.example.net has no SPF record of its own. That is fine once DMARC rejects it, but you can also add a wildcard:

*.example.net. IN TXT "v=spf1 -all"

Check that no real subdomain needs a different TXT record before adding a wildcard.

Domains that receive email but never send it

Keep the SPF and DMARC records, but do not add the null MX: keep your normal MX records instead. Common examples are domains used only for inbound aliases.

Who asks for this

The UK government publishes this as standard guidance, and the Australian ISM controls on SPF and DMARC (ISM-0574, ISM-1183, ISM-1540) apply to all of an organisation's domains, not just the ones that send. Parked domains are the easiest ones to miss.

Check each domain

Run each parked domain through the domain check. A correctly locked-down domain shows SPF with -all and no lookups, DMARC at reject, and a null MX.